JWT and JWKS for server to server calls

Question

I have an application that uses an OAUTH2 flow based on JWT and JWKS.

JWT and JWKS are used for the "client authentication": when the application needs to call the endpoint to flip the authorization code to an access token, instead of using a shared secret, it uses a signed JWT. The authentication service will call the JWKS endpoint implemented by the application to retrieve the public key and validate the JWT.

Given that I have already all of this in place, I am wondering if I can use the same mechanism to authenticate server to server calls.

The idea is that the authorization service can expose an endpoint that will return an access token for the application itself instead of an actual user (I can configure a service account that will get authenticated when using this flow).

This means that the first steps of the OAUTH2 flow, where the user is authenticated, are not necessary. The authorization service will only authenticate the client - validating the signed JWT sent by the client application - and generate an access token for a predefined service account.

Do you see any problems with this?

Answer 1

I do not know if it would be better to cancel this question, but just in case someone else is looking for the same solution, the answer is that there is already a well defined flow with grant_type equals to client_credentials that works exactly as described in my question.